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Abstract 



We present a fibre-optical quantum key distribution system. It works at 1550nm and is based on 
the plug&play setup. We tested the stability under field conditions using aerial and terrestrial cables 
' and performed a key exchange over 67 km between Geneva and Lausanne. 



I Introduction 



Quantum cryptography or, more exactly, quantum key distribution (QKD) is the most advanced subject 
in the field of quantum information technologies. Since the introduction of the BB84 protocol by Bennett 
• and Brassard in 1984 Q and their first implementation in 1992 many experiments have been performed 

by numerous groups (see e.g. || for a review). However, to our knowledge, all experiments to date were 
CN| ' performed in laboratories or used laboratory equipment (e.g. liquid nitrogen cooled the detectors) or 

needed frequent alignments (e.g. control of polarisation or phase). In this paper, we present a turn- key, 
fibre-optic QKD- prototype that fits into two 19" boxes, one for Alice and one for Bob (see Fig.l). We 
Q-i! tested the stability of the auto-compensating plug&play system || over installed terrestrial and aerial 

fjj ■ cables. Keys were exchanged over a distance of 67 km. 

We start with a short introduction to the plug&play auto-compensating setup, before describing the 
features of the prototype. We then recall the relevant parameters of a QKD system and shortly discuss 
some security issues. Finally the results of the field tests are presented. 



II Plug&Play Prototype 

Let's recall the principle of the so called plug&play auto-compensating setup (J, ||, |[ [t], where the key 
is encoded in the phase between two pulses travelling from Bob to Alice and back (see Fig. 2) . A strong 
laser pulse (@1550 nm) emitted at Bob is separated at a first 50/50 beamsplitter (BS). The two pulses 
impinge on the input ports of a polarisation beamsplitter (PBS), after having travelled through a short 
arm and a long arm, including a phase modulator (PMb) and a 50 ns delay line (DL), respectively. All 
fibres and optical elements at Bob are polarisation maintaining. The linear polarisation is turned by 90 
degrees in the short arm, therefore the two pulses exit Bob's setup by the same port of the PBS. The 
pulses travel down to Alice, are reflected on a Faraday-mirror, attenuated and come back orthogonally 
polarized. In turn, both pulses now take the other path at Bob and arrive at the same time at the BS 
where they interfere. Then, they are detected either in D 1: or after passing through the circulator (C) 
in D2. Since the two pulses take the same path, inside Bob in reversed order, this interferometer is 
auto-compensated. To implement the BB84 protocol, Alice applies a phase shift of or tt and § or ^ 
on the second pulse with PM^. Bob chooses the measurement basis by applying a or | shift on the 
first pulse on its way back. 
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The prototype is easy to use. The two boxes just have to be connected via an optical fibre. They 
are exclusively driven by two computers via the USB port. The two computers communicate via a 
ethernet/internet link. The system monitors on-line the temperature of the detectors, radiators and 
cases. The photon counters are Peltier-cooled, actively gated, InGaAs/InP APD's The darkcount 
noise of the detectors is measured during the initialization (the darkcount probability Pdark is «10 -5 per 
gate). Although the setup needs no optical alignment, the phases and the detection gates must be applied 
at the right time. Therefore, the system measures in a next step the length of the link (the operator 
has only to estimate the line's length at more or less 5 km). The variable attenuator (VA) at Alice is 
set to a low level and bright laser pulses are emitted by Bob. The time delay between the triggering 
of the laser and a train of gates of the detectors is scanned until the reflected pulses are detected. The 
delays for the two 2.5 ns detection gates are adjusted, as well as the timing for the 50 ns pulse applied 
on the phasemodulator PM^ . In the plug&play scheme, where pulses travel back and forth, (Rayleigh) 
backscattered light can considerably increase the noise. Therefore, the laser is not continuously pulsed, 
but trains of pulses are sent, the length of these trains corresponding to the length of the storage- line 
introduced for this purpose behind the attenuator at Alice's]^]. Consequently, the backward propagating 
pulses do no longer cross bright pulses in the fibre. For a storage line measuring approximately 10 km, 
a pulse train contains 480 pulses at a frequency of 5 MHz. A 90% coupler (BS 10 /go) directs most of the 
incoming light pulses to a APD-detector module (D^). It generates the trigger signal used to synchronise 
Alice's 20 Mhz clock with the one of Bob. This synchronized clock allows Alice to apply a 50 ns pulse 
at the phasemodulator PM^ exactly when the second, weaker pulse passes. Only this second pulse 
contains phase information and must be attenuated below the one-photon-per-pulse level. Measuring the 
height of the incoming pulses with would allow to adjust the attenuator in order to obtain the right 
average number of photons per outgoing pulse. For this purpose, the attenuator and the detector must 
be calibrated beforehand. In practice, we measure the incoming power with a power-metre. Random 
numbers are generated on both sides with a quantum random number generator |Tc| . At Bob, clicks from 
each of the photon counters are written together with the index of the pulse into a buffer and transferred 
to the computer. 

As a measure of security, the number of coincident clicks at both detectors is registered, which is important 
to limit beamsplitting attacks (see below). Morover, the incoming power at Alice is continuously measured 
with D^, in order to detect so called Trojan horse attacks. 



Ill Key parameters in QKD 
III.l Key and error rates 

The first important parameter is the raw key rate R raw between Alice, the transmitter, and Bob, the 
receiver: 

Rraw = qvut AB t B r/ B C 1 ) 

where q depends on the implementation (A for BB84 protocol, because half the time Alice and Bob bases 
are not compatible), v is the repetition frequency, fj, is the average number of photons per pulse, t AB 
is the transmission on the line Alice-Bob, t B is Bob's internal transmission (t B ~ 0.6) and r/ B is Bob's 
detection efficiency (rj B ss 0.1). 

After R raw the second most important parameter is the quantum bit error rate (QBER) which consists 
of four major contributions: 

QBER — ^ — = QBER pt + QBERdark + QBER a f ter + QBER stray (2) 

total counts 

QBER pt is simply the probability for a photon to hit the false detector. It can be measured with strong 
pulses, by always applying the same phases and measuring the ratio of the count rates at the two detectors. 
This is a measure of the quality of the optical alignment of the polarisation maintaining components and 
the stability of the fibre link. In the ideal case, QBER opt is independent of the fibre length. QBERdark 
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and QBER a fte r , the errors due to darkcounts and afterpulses, depend on the characteristics of the photon 
counters]^]. QBERdark is the most important, it is the probability to have a darkcount per gate Pdark, 
divided by the probability to have a click pdet ■ 

n R rr B ~ Pdark 



fltABtBllB 



QBERdark increases with the distance and consequently limits the range of QKD. QBER a fter is the 
probability to have an after pulse p a fter(t) summed over all gates between to detections: 



n=— L — 

QBER a f ter = ^ Pafter [r + 71- J 



(3) 



Pafter, depending on the type of APD and on the temperature, decreases rapidly with time|jj]. Neverthe- 
less for high pulse rates [y— 5 MHz) QBER a fter can become significant. For instance, for pdet = 0.15% 
(corresponding to about 7 dB loss with /j, = 0.1) we measured a QBER a fter of about 4%. By introducing 
a dead time r of 4 [is (during this time, following a detection, no gates are applied), QBER a fter can be 
reduced to 1.5%. The bit rate R ra w on the contrary, is only slightly reduced by a factor r\ r : 

Vr = ~, " £ 1 (4) 

In this example, r\ r becomes 0.97 and 0.92, for 4 and 12 [is, respectively. In our prototype the deadtime 
can be varied between and 12 /is. The optimum deadtime varies as a function of distance, in our 
measurements, however, we applied a constant deadtime of 4 [is. Finally, QBER str ay, the errors induced 
by stray-light, essentially Rayleigh back-scattered light, is a problem proper to the plug&play setup. It 
can be almost completely removed with the help of Alice's storage line and by sending trains of pulses 
as mentioned above. However, we have to introduce another factor T] duty that reduces our bit rate. It 
gives the duty cycle of the emitted pulse-trains and depends on the length of Alice's delay line Id and 
the length of the fibre link Iab- 

Vduty — ~~r~ (5) 

lab + Id 



Hence with our prototype we can expect a raw rate of R raw of about 

Iab + Id 



Rraw = qvfit AB t B ri B r) duty ri T w UOkHz ( [it A B-, — ° , ) (6) 



III. 2 Error correction, privacy amplification and eavesdropping 

The net secret key rate is further reduced during the error correction and privacy amplification process 
by a factor of rj dist . We didn't implement error correction and privacy amplification for our field tests, 
but we would like to estimate roughly the net key rate that could be obtained with our system. In theory, 
ridist is simply given as the difference between the mutal information of Alice and Bob, Iab, and Alice 
and Eve, Iae @ : 

Vdist = Iab{D) - Iae (7) 

Due to the errors, Iab is smaller than 1. It is a function of the disturbance D, which is equal to the total 
QBER: 

Iab = 1 + Dlog 2 D + (1 - D)log 2 (\ - D) (8) 

In the following we estimate the information of Eve, Iae- In the line of Felix et.al. |ll| we make the 
following assumptions: 

- The measured QBER should, within the statistical limits, be equal to what is estimated according eq.||. 
If this is not the case, a real user won't proceed and blindly apply privacy amplification, he will stop 
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the key exchange and look for the problem. If the QBER is within these limits, we attribute to Eve the 
QBER op t (<0.5%) plus the error (2a) of the error estimation (< 0.5% for reasonably long keys), say 1% 
in total. In the case of perfect equipment of the eavesdropper and true single photon source this error 
corresponds to an information of — 3%[p"3|. 

- In the case of faint laser pulses and especially in the presence of high fibre losses, Eve can take advantage 
of multi-photon pulses and gain information while creating less or no errors |nj. In this case, it is 
important to measure the length of the line and to register coincident clicks at Bob's two detectors in 
order to limit Eve's possibilities. We assume that Eve possesses perfect technology, but cannot efficiently 
measure the number of photons without disturbing them and cannot store them. Further, she disposes 
of fibers with losses as low as 0.15dB/km. Under these assumptions one can calculate Eve's information 
per bit due to multi-photon pulses I 2 u and obtains about 0.06, 0.14 and 0.40 for, 5, 10 and 20 dB loss, 
respectively (for = 0.2 , 0.25dB/km fiber loss and 10 s pulses sent). Consequently, we obtain 



'AE 



0.03 + I 2v (9) 



With equations and || we can caluclate a theoretical value of rj dist . In practice, f] dist will be smaller 
due to the limitations of the used algorithm. Privacy amplification can be performed without additional 
bit loss in contrary to error correction. For our estimation, we use the results of Tancewsky et al jl2) for 
I' AB after error correction 

l' AB = l + Dlog 2 D- 7 -D (10) 
which is in fact considerably smaller than Iab ■ The information of Eve Iae is reduced by the same factor 

lAl 



■f 42 ', too. Finally, we obtain the following estimation of R ne t' 



Rnet = VdistRraw — (J- AB ~ ^Ae)~^ Rraw (H) 

±AB 



1 + Dlog 2 D (0.03 + 7 2i/ )(l - (1 - D)log 2 {\ - D) - -D) 



Rraw (1^) 



IV Field measurements 



IV. 1 Visibilities 

In principle the prototype can be tested in the lab by performing key exchange with different fibre 
losses and compare the measured QBER and bit rates with the estimated values according to the simple 
formulas developed above. There are two motivations for field tests on installed cables. The first reason 
is to check, if the auto-compensating setup is robust in many different situations. Several effects could 
reduce the visibility of the interference. First, we have previously shown that Faraday rotation due to the 
earth magnetic field cannot considerably decrease the visibility (m). Second, the time delay between the 
two pulses, travelling back and forth between Alice and Bob, could change due to a temperature drift. 
Let's assume that the temperature of the fiber increases with a rate 6 [^] . The time delay At between 
the two pulses is 54ns. If 6 is constant for the whole trip of the pulses, the second pulse will see a fibre 
that is longer by Al : 

y = aAT (13) 
Al = a2l AB AT = a2l AB 0At (14) 

With a = 10~ 5 , Iab = 50km, 6 = 10 [^] we obtain 150pm <C A. Hence this effect should be 
negligable especially since installed fibres have slow temperature drifts. On the contrary, slow temperature 
induced length drifts can be large enough that frequent readjustment of Bob's delay become necessary. In 
fact, we noticed that during the heating up of Alice's box within the first hour of operation, the changes 
in the delay line require a recalibration every 10 minutes or so. However, a bad synchronisation of the 
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detection window does not affect QBER opt . Finally, mechanical stress could change the fiber length 
and/or birefringence. If the birefringence changes rapidly, the pulses are no longer orthogonally polarized 
at the input of Bob, despite the Faraday mirror. In this case the two pulses might suffer different losses at 
Bob's polarizing beamsplitter and the interference will no longer be perfect. Rapid changes in stress are 
unlikely in installed cables, a couple of meters below the surface. For this reason we tested the prototype 
also over an aerial cable. We had at our disposition two fibres of 4.35 km length, whereof 2.5 km in an 
aerial cable. In order to amplify a hypothetical effect we put Alice and Bob side by side and passed twice 
through the cable (config. A). In configuration B we inserted 1 spool of about 15 km at the other end of 
the cable. Hence, the pulses made the following trip: Bob, the aerial cable, 15 km spool, the aerial cable, 
15 km Alice with her 10 km storage line and back. 

To measure the visibilities we send relatively strong pulses (a couple of photons per pulse) with always 
the same, compatible phase values and look at the counts on the two detectors, R r i g ht and R wron g 
(substracting the counts due to detector noise). We obtain then the fringe visibility according to the 
standard definition: 

y Rright Rwrong (15) 

Rright + R wrojiq 

and the corresponding QBER opt : 

QBER p t = (16) 

Table 1 summerises the result of visibility measurements over different cables. The indicated visibilities 
are the mean values over all four possible compatible phase settings. There was no considerable decrease 
of the visibility in any fibre, hence the auto-compensating interferometers worked well under all tested 
conditions. 



fibre 


length [km] 


loss [dB] 


Visibility [%] 


Geneva-Nyon (under lake) 


22.0 


4.8 


99.70 ± 0.03 


Geneva-Nyon (terrestrial) 


22.6 


7.4 


99.81 ± 0.03 


Nyon-Lausanne (terrestrial) 


37.8 


10.6 


99.63 ± 0.05 


Geneva-Lausanne (under lake) A 


67.1 


14.4 


99.62 ± 0.06 


Geneva-Lausanne (under lake) B 


67.1 


14.3 


99.66 ± 0.05 


Ste Croix (aerial) A 


8.7 


3.8 


99.70 ± 0.01 


Ste Croix (aerial) B 


23.7 


7.2 


99.71 ± 0.01 



Table 1: Visibility measurements on different fibres 



We tried to simulate an extremely unstable fibre link in the lab. For this purpose, we put a fibre-optical 
polarisation scrambler (GAP-optique) at the output of Bob followed by 25 km of fibre. We measured the 
visibility as function of the scrambler frequency. This frequency is defined as the number of complete 
circles that the vector of polarisation would describe per second on the Poincare sphere, if the birefringence 
changed uniformly. The visibility drops from 99.7% to 99.5% and 98% at frequencies of 40 Hz and 100 
Hz respectively. This shows that the visibilities can decrease under rapid perturbations, however, it's 
unlikely to find such conditions using installed fibres. 

IV. 2 Key exchange 

We performed key exchange over different installed cables, the longest connecting the cities of Lausanne 
and Geneva (see Fig. 3). We used always the same file of random numbers, in a way that Bob could make 
the sifting and calculation of error rate without communication. We estimated the net key rate using 
equation ([ll]). Table 2 gives an overview of the exchanged keys with pt = 0.2. 
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fibre 


length [km] 


Key [kbit] 




QBER [%] 


R net [kHz] 


Geneva-Nyon (under lake) 


22.0 


27.9 


2.06 


2.0±0.1 


1.51 


Geneva-Nyon (terrestrial) 


22.6 


27.5 


2.02 


2.1±0.1 


1.39 


Nyon-Lausanne (terrestrial) 


37.8 


25.1 


0.50 


3.9±0.2 


0.26 


Geneva-Lausanne (under lake) A 


67.1 


12.9 


0.15 


6.1±0.4 


0.044 


Geneva-Lausanne (under lake) B 


67.1 


12.9 


0.16 


5.6±0.3 


0.051 


Ste Croix (aerial) A 


8.7 


63.8 


6.29 


3.0±0.1 


4.34 


Ste Croix (aerial) B 


23.7 


117.6 


2.32 


3.0±0.1 


1.57 



Table 2: Overview of exchanged keys over different fibres (/x = 0.2). 



We notice that secure key exchange is possible over more than 60 km with about 50 Hz of net key rate. 

Conclusion 

We presented a QKD prototype, which can be simply plugged into the wall, connected to a standard 
optical fibre and a computer via the USB port. It allows key exchange over more than 60 km, with a net 
key rate of about 60 bits per second. The system is commercially available 

V Figures 

Figure 1: Picture of the p&p system 
Figure 2: Schematic of the p&p prototype 

Figure 3: Satellite view of Lake Geneva with the cities of Geneva, Nyon and Lausanne. 
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